CVE-2024-42642

Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
http://microncrucial.com	Broken Link
https://github.com/VL4DR/CVE-2024-42642/tree/main	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:crucial:mx500_firmware:m3cr046:*:*:*:*:*:*:*

OR	cpe:2.3:h:crucial:ct1000mx500ssd1:-:::::::*
	cpe:2.3:h:crucial:ct2000mx500ssd1:-:::::::*
	cpe:2.3:h:crucial:ct250mx500ssd1:-:::::::*
	cpe:2.3:h:crucial:ct4000mx500ssd1:-:::::::*
	cpe:2.3:h:crucial:ct500mx500ssd1:-:::::::*

History

No history.

Information

Published : 2024-09-04 20:15

Updated : 2024-10-24 17:35

NVD link : CVE-2024-42642

Mitre link : CVE-2024-42642

CVE.ORG link : CVE-2024-42642

JSON object : View

Products Affected

crucial

ct2000mx500ssd1
mx500_firmware
ct4000mx500ssd1
ct500mx500ssd1
ct1000mx500ssd1
ct250mx500ssd1

CWE

CWE-787

Out-of-bounds Write

{"id": "CVE-2024-42642", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.8}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-09-04T20:15:07.007", "references": [{"url": "http://microncrucial.com", "tags": ["Broken Link"], "source": "cve@mitre.org"}, {"url": "https://github.com/VL4DR/CVE-2024-42642/tree/main", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-787"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-787"}]}], "descriptions": [{"lang": "en", "value": "Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller."}, {"lang": "es", "value": "Micron Crucial MX500 Series Solid State Drives M3CR046 son vulnerables al desbordamiento de b\u00fafer, que puede desencadenarse al enviar paquetes ATA especialmente manipulados desde el host al controlador de la unidad."}], "lastModified": "2024-10-24T17:35:08.450", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:crucial:mx500_firmware:m3cr046:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "294AB13C-B72A-4A2A-9479-0679E8F14CBE"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:crucial:ct1000mx500ssd1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9B1C100C-AEBD-4F78-B44B-964596EF0BEB"}, {"criteria": "cpe:2.3:h:crucial:ct2000mx500ssd1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "53994271-93E3-4F6A-A518-508A7AF1DE2E"}, {"criteria": "cpe:2.3:h:crucial:ct250mx500ssd1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8086BDF7-E0E1-4AC9-8944-F3882ABB529C"}, {"criteria": "cpe:2.3:h:crucial:ct4000mx500ssd1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C762652B-FB0E-4268-9C1F-2540298A4C21"}, {"criteria": "cpe:2.3:h:crucial:ct500mx500ssd1:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A300BCAD-C58A-499B-A82D-5D7D484672E0"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}